Welcome to today’s What’s New on GitHub roundup. Below are seven repositories from GitHub Trending (daily), followed by the most important updates from the GitHub Changelog over the last day. Star counts are exactly as GitHub showed them on the evening of 10 November 2026 (IST), so they’ll have moved by the time you read this.

Two themes stand out today. Reusable “skills” for AI coding agents are everywhere, and a Rust web framework from the Tokio team is getting a lot of attention.

Trending Repositories

1. addyosmani/agent-skills

Language: JavaScript · Stars: 114,916 (465 today)

“Production-grade engineering skills for AI coding agents.” It’s a collection of packaged instructions and workflows that coding agents can load to handle engineering tasks more consistently.

Why devs care: if you use agents that support skills, you can start from a curated library instead of writing every prompt and checklist yourself, and see how experienced engineers structure them.

2. anthropics/claude-quickstarts

Language: Python · Stars: 20,333 (530 today)

“A collection of projects designed to help developers quickly get started with building deployable applications using the Claude API.” Each quickstart is a small working app you can clone and adapt.

Why devs care: with Claude Fable 5.2 arriving in the API and in GitHub Copilot this week, these are a quick way to get a real project running instead of piecing together snippets.

3. homeassistant-ai/ha-mcp

Language: Python · Stars: 6,438 (792 today)

“Configure and automate Home Assistant with Claude, ChatGPT, and other AI assistants.” It’s an MCP (Model Context Protocol) server that gives AI assistants structured access to a Home Assistant setup.

Why devs care: it’s a practical, real-world example of how to expose a large, stateful system to AI assistants through MCP, and it’s useful for anyone automating a smart home.

4. cloudflare/security-audit-skill

Language: JavaScript · Stars: 68,818 (1,206 today)

“A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings.” It runs an audit in stages and produces structured results instead of a wall of text.

Why devs care: machine-readable, verified findings can feed into CI or issue trackers, which makes AI-assisted security reviews far easier to act on than chat output.

5. tokio-rs/topcoat

Language: Rust · Stars: 6,658 (192 today)

“A batteries-included framework for building web apps,” from the organisation behind the Tokio async runtime.

Why devs care: Rust web development has usually meant assembling many crates yourself. A batteries-included framework from the Tokio team could lower that barrier a lot. Worth watching if you like the Rails/Laravel experience but want Rust’s performance.

6. every-app/open-seo

Language: TypeScript · Stars: 27,150 (146 today)

“Open source alternative to Semrush and Ahrefs.” It aims to bring keyword and site-analysis workflows into a self-hostable, open-source tool.

Why devs care: SEO tooling subscriptions are expensive. An open, hackable option is attractive for indie developers, bloggers and agencies who want to own their data.

7. coollabsio/coolify

Language: PHP · Stars: 65,891 (60 today)

An open-source, self-hostable PaaS and an alternative to Vercel, Heroku and Netlify. It deploys static sites, databases and full-stack apps, and offers 360+ one-click services on your own servers.

Why devs care: you get a Heroku-like deploy experience on a cheap VPS without vendor lock-in. It’s also a good, large, real-world Laravel/PHP codebase to learn from.

GitHub Changelog: The Last Day

Dependabot alerts will pause on inactive repositories (10 Nov)

  • Starting 8 December 2026, Dependabot alerts will be turned off on most repositories that have had no activity in the past year.
  • Existing alerts are archived, not deleted.
  • “Activity” means a push to any branch or tag, creating the repository, or turning on alerts. Any push turns alerts back on.
  • Repositories under enforced security configurations are exempt. The change doesn’t apply to GitHub Enterprise Server.

What to do: if you rely on alerts for old but still-deployed projects, make sure they’re covered by an enforced security configuration, or expect alerts to pause.

Claude Fable 5.2 in GitHub Copilot (9 Nov)

  • Generally available for Copilot Pro+, Max, Business and Enterprise.
  • Business and Enterprise admins need to enable the model policy, which is off by default.
  • Data retention is required by default. There’s a zero-data-retention exemption for eligible enterprises until the end of the year.
  • It’s rolling out gradually across VS Code, Visual Studio, Copilot CLI, the coding agent, github.com, GitHub Mobile, JetBrains, Xcode and Eclipse.

Secret scanning detects secrets in GitHub Actions workflow logs (9 Nov)

  • Public preview for GitHub Enterprise Cloud customers with Secret Protection or GitHub Advanced Security.
  • Enterprise owners enable it under Policies → Advanced Security.
  • There’s no backfill of existing logs. Generic, custom-pattern, AI-detected and already-masked secrets aren’t detected, and there are no notifications during the preview.

Reminder: pull_request_target brownout on 16 Nov

The second pull_request_target brownout runs on 16 November, 16:00–18:00 UTC (21:30–23:30 IST), ahead of default blocking on 2 December. See our step-by-step migration guide.

Quick Commands to Explore

# Clone and look around today's picks
gh repo clone tokio-rs/topcoat
gh repo clone anthropics/claude-quickstarts

# Star a repo from the terminal
gh api -X PUT /user/starred/homeassistant-ai/ha-mcp

Takeaway

Agent skills, MCP servers and security-focused AI tooling are still the strongest trend on GitHub. Tokio’s Topcoat and Coolify show that “batteries-included” and “self-hosted” also remain popular. On the platform side, check your Dependabot coverage on quiet repositories before 8 December, and your pull_request_target workflows before 2 December. Thanks for reading, and see you in tomorrow’s roundup with a fresh set of repositories and platform updates.